|
266721
|
2.7 |
LOW
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2016-11077
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266722
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
|
CWE-295
Improper Certificate Validation
|
CVE-2016-11076
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266723
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
|
CWE-200
Information Exposure
|
CVE-2016-11075
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266724
|
9.8 |
CRITICAL
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
|
CWE-287
Improper Authentication
|
CVE-2016-11074
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266725
|
6.1 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
|
CWE-79
Cross-site Scripting
|
CVE-2016-11073
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266726
|
6.5 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
|
CWE-287
Improper Authentication
|
CVE-2016-11072
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266727
|
6.1 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
|
CWE-79
Cross-site Scripting
|
CVE-2016-11071
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266728
|
5.4 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
|
CWE-79
Cross-site Scripting
|
CVE-2016-11070
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266729
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
|
CWE-521
Weak Password Requirements
|
CVE-2016-11069
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266730
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
|
CWE-74
Injection
|
CVE-2016-11068
|
2024-11-21 11:45 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|